Information Commissioner's Office
Blog: Adtech - the reform of real time bidding has started and will continue
A blog by Simon McDougall, ICO Executive Director of Technology and Innovation
The adtech real time bidding (RTB) industry is complex, involving thousands of companies in the UK alone. Many different actors and service providers sit between the advertisers buying online advertising space, and the publishers selling it.
There is a significant lack of transparency due to the nature of the supply chain and the role different actors play. Our June 2019 report identified a range of issues. We are confident that any organisation that has not properly addressed these issues risks operating in breach of data protection law.
This is a systemic problem that requires organisations to take ownership for their own data processing, and for industry to collectively reform RTB. We gave industry six months to work on the points we raised, and offered to continue to engage with stakeholders. Two key organisations in the industry are starting to make the changes needed.
The Interactive Advertising Bureau (IAB) UK has agreed a range of principles that align with our concerns, and is developing its own guidance for organisations on security, data minimisation, and data retention, as well as UK-focused guidance on the content taxonomy. It will also educate the industry on special category data and cookie requirements, and continue work on some specific areas of detail. We will continue to engage with IAB UK to ensure these proposals are executed in a timely manner.
Separately, Google will remove content categories, and improve its process for auditing counterparties. It has also recently proposed improvements to its Chrome browser, including phasing out support for third party cookies within the next two years. We are encouraged by this, and will continue to look at the changes Google has proposed.
Finally, we have also received commitments from other UK advertising trade bodies to produce guidance for their members.
If these measures are fully implemented they will result in real improvements to the handling of personal data within the adtech industry. We will continue to engage with industry where we think engagement will deliver the most effective outcome for data subjects.
This progress has only been possible through the investment of substantial time and goodwill by many industry participants. However, while many organisations are on board with the changes that need making, some appear to have their heads firmly in the sand. It is now clear to us that engagement alone will not address all these issues. For instance, we have reviewed a number of justifications for the use of legitimate interests as the lawful basis for the processing of personal data in RTB. Our current view is that the justification offered by organisations is insufficient. Furthermore, the Data Protection Impact Assessments we have seen have been generally immature, lack appropriate detail, and do not follow the ICO’s recommended steps to assess the risk to the rights and freedoms of the individual. We have also seen examples of basic data protection controls around security, data retention and data sharing being insufficient.
We are using the intelligence gathered throughout last year to develop an appropriate regulatory response. We will continue to investigate RTB. While it is too soon to speculate on the outcome of that investigation, given our understanding of the lack of maturity in some parts of this industry we anticipate it may be necessary to take formal regulatory action and will continue to progress our work on that basis.
The most effective way for organisations to avoid the need for further regulatory scrutiny or action is to engage with the industry reform and transformation, and to encourage their supply chain to do the same. I am both heartened at how much progress we have made, and disappointed that there are some who are still ignoring our message. Those who have ignored the window of opportunity to engage and transform must now prepare for the ICO to utilise its wider powers.
Original article link: https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2020/01/blog-adtech-the-reform-of-real-time-bidding-has-started/
Latest News from
Information Commissioner's Office
ICO issues Ministry of Justice with reprimand after confidential personal information left in prison holding area26/05/2023 12:10:00
The ICO has issued a formal reprimand to the Ministry of Justice (MoJ) after confidential waste documents were left in an unsecured prison holding area.
“It’s important not to get caught out.” - New SARs guidance for employers issued24/05/2023 16:05:00
The Information Commissioner’s Office (ICO) has today published new guidance for businesses and employers on responding to Subject Access Requests (SARs)
Information Commissioner John Edwards' opening remarks at the European Parliament’s Committee on Civil Liberties, Justice and Home Affairs (LIBE), delivered on 23 May 2023.23/05/2023 12:25:00
Information Commissioner John Edwards' opening remarks at the European Parliament’s Committee on Civil Liberties, Justice and Home Affairs (LIBE), delivered today.
ICO fines two businesses £180,000 for making unlawful marketing calls17/05/2023 09:10:00
Regulator launches three new videos aimed at helping small businesses navigate electronic communications law.
ICO takes action against both Plymouth City Council and Norfolk County Council for failing to respond to information access requests16/05/2023 09:10:00
The Information Commissioner’s Office (ICO) has reprimanded two councils that have failed to respond to the public when asked for personal information held about them – known as a Subject Access Request (SAR).
ICO takes action against Shropshire Council for failing to respond to Freedom of Information requests10/05/2023 09:10:00
The Information Commissioner’s Office (ICO) has issued an enforcement notice to Shropshire Council for its poor handling of requests made under the Freedom of Information Act (FOIA) 2000.
Necessity and proportionality: questions police must ask when considering sharing personal information with the public09/05/2023 15:25:00
In February, the ICO announced it would be asking Lancashire Police to set out how they reached the decision to include personal information in media statements as they sought to find Nicola Bulley.
Blog: Protecting privacy during a pandemic: our work on the UK’s Covid apps28/04/2023 12:25:00
The ICO’s work is often in the headlines, and our recent enforcement action against TikTok for allowing over a million UK children to use its platform without parental consent brought international media attention.
ICO launches FOI toolkit topic to help public bodies deal with vexatious requests26/04/2023 10:20:00
Continuing with its commitment to improving freedom of information (FOI) services, the Information Commissioner’s Office (ICO) has launched the third topic in its FOI toolkit to enable public authorities to self-assess how they deal with vexatious requests.